Mercury lets ChatGPT and Claude request payments and transfers through MCP write actions

What Mercury published on 15 October

Mercury's release notes for 15 October 2026 say customers can now ask ChatGPT or Claude to move money, pay a recipient or categorise transactions on a Mercury account. The company frames the change as grounded answers plus actions that still wait for human approval before money moves. People who already connected Mercury are told to reconnect once to enable actions.

The deeper documentation lives under Mercury's MCP docs. What is Mercury MCP? describes a hosted server that connects AI tools to a Mercury account through OAuth. The page is explicit that the MCP is in beta while Mercury studies the limits of chat models, and that users should double-check important answers against the Mercury account itself.

This is not a new bank. It is an expansion of an existing MCP connection from read-mostly account context into a short, scoped list of write tools. That distinction matters for anyone comparing it with full banking APIs or with agent checkout products that move money inside a merchant flow.

The five write tools and their OAuth scopes

Mercury's supported tools page lists five write tools and the OAuth scope each one needs. requestSendMoney needs transactions:request and creates a payment request to an existing recipient. requestTransferMoney needs transfers:request and creates an internal transfer request between the user's own Mercury accounts. createCategory and editCategory need categories:create and categories:edit. updateTransaction needs transactions:update and can change or clear a transaction's note or category.

Example prompts in the docs are plain language: request a $500 payment to Acme from checking; request a $1,000 transfer from checking to savings; create a Software category; rename it; categorise a transaction and add a note. Recipients must already exist for payments. The write tools do not create recipients, delete categories, issue cards or create invoices, even though Mercury's public API covers some of those jobs.

A connection without a tool's required scope simply cannot call that write tool. A write scope also does not grant permission to approve a payment or bypass Mercury's approval policies. That split—prepare in chat, approve in Mercury—is the product's core safety claim.

How payment and transfer approval actually works

For money movement, Mercury's docs repeat the same sequence. Ask the AI tool to prepare the request, open Mercury, find the item under Needs approval in Tasks or Payments, review recipient or destination, amount, method and timing, then approve if you are an eligible approver. Connecting Mercury MCP stresses that creating a request, or confirming it in the AI tool, does not mean the payment has been sent.

Organisation approval policies still apply. If those policies would otherwise let an action through without approval, Mercury still requires the requester to approve the MCP-created request in Mercury. Chat confirmation is not a substitute. The docs also tell users to check for an existing request with listSendMoneyApprovalRequests or the transfer-approval list tools before creating another one after an uncertain result.

That human-in-the-loop design sits next to other agent-money stories on this site, from Shopify's Shop MCP checkout path to Ledger's Agent Intent hardware signer. Mercury's version keeps the bank ledger and the approval UI inside Mercury rather than pushing final authority into the chat client.

What changes immediately without an approval queue

Not every write tool waits in an approval queue. Creating or editing a custom expense category, and updating a transaction's note or category, apply immediately once the connection has the matching scope. Those actions do not move money, but they can overwrite existing labels and notes.

Mercury's security page treats that difference as a risk surface, not a footnote. Immediate metadata edits are still write actions. Prompt injection or a confused agent can mis-label spend or clear notes even when it cannot empty an account. Teams that only wanted read-only AI summaries need to decide whether category write scopes belong in the same connection as payment requests.

How to turn write access on

New users connect through their AI tool's connector flow and Mercury's OAuth consent screen. Existing read-only connections do not inherit write access. Mercury says you must sign in again and explicitly grant the write permissions on the consent screen.

Connection controls differ by client. Asking for a write in chat does not by itself grant write access. Mercury permissions on the account and the capabilities available to that account still apply. Business-only tools remain limited to eligible business accounts, which is the same rule the read-tool catalogue already used.

Security limits Mercury documents

Security best practices tell customers to use MCP clients from trusted sources, review permissions before authorising a client, and remember that write access can create payment requests, change categories and edit notes. The page separates money-movement requests, which need Mercury approval, from immediate metadata changes.

Mercury also warns about prompt injection: malicious instructions in untrusted tools or agent workflows could try to exfiltrate transaction data or create unwanted payment requests and category edits. The approval queue for money movement does not protect against every data disclosure or every immediate edit. That is a clearer statement than many "AI banking" launches make.

The caution rhymes with other agent-risk coverage here, including JPMorgan's block on outside AI agents for Chase accounts and American Express's Intent Intelligence framework for agent purchases. Banks and card networks are inventing different control planes for the same problem: an agent that can talk is not the same as an agent that should spend.

Why this matters for agentic banking

For startups already on Mercury, the practical upside is speed: ask ChatGPT or Claude for balances, recent spend and a prepared payment without opening another spreadsheet, then finish in the familiar Mercury approval UI. For finance teams, the value is the audit trail staying inside Mercury rather than depending on chat logs.

For the wider MCP ecosystem, Mercury is one of the clearer examples of bank-grade write actions with an explicit reauthorization step and a documented tool table. That is useful reference material even for teams that will never bank with Mercury, because it shows how a regulated product can expose write tools without pretending chat is the settlement layer.

What is still missing

Still missing from the public docs: which ChatGPT and Claude plan tiers get the connector; rate limits; a dated changelog entry inside the docs pages themselves beyond the release notes headline; independent red-team results; and any statement about whether other MCP clients besides ChatGPT and Claude are supported for the same write scopes today.

Also missing is a rights-cleared Mercury brand image for press use, which is why this article uses a labeled AI-generated illustration instead of a logo lockup. If Mercury publishes a press kit with editorial terms, a later update can swap the cover.

Until then, the durable facts are the ones in the release note and the tool table: five write actions, OAuth-scoped, money movement approval-gated, metadata edits immediate, and old read-only connections left unchanged until the user reconnects.